{"id":47527,"library":"express-force-https-schema","title":"express-force-https-schema","description":"Configurable Express middleware that forces HTTPS based on the X-Forwarded-Proto header, commonly used behind proxies like Heroku, AWS ELB, and Nginx. Version 1.0.3 is the latest stable release (last updated 2018, in maintenance mode). It uses a header-based check rather than direct protocol detection, making it suitable for load-balanced or containerized environments. Unlike similar middleware (e.g., express-sslify), it provides options to skip certain user agents and disable the check via an enabled flag.","status":"maintenance","version":"1.0.3","language":"javascript","source_language":"en","source_url":"ssh://git@github.com/kilhage/express-force-https-schema","tags":["javascript","express","https","aws","heroku","x-forwarded-proto","force"],"install":[{"cmd":"npm install express-force-https-schema","lang":"bash","label":"npm"},{"cmd":"yarn add express-force-https-schema","lang":"bash","label":"yarn"},{"cmd":"pnpm add express-force-https-schema","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"peer dependency; required as middleware for Express applications","package":"express","optional":false}],"imports":[{"note":"The package ships as an ESM default export. CommonJS users must use the default import pattern or check compatibility.","wrong":"const forceHttpsSchema = require('express-force-https-schema')","symbol":"default","correct":"import forceHttpsSchema from 'express-force-https-schema'"},{"note":"The import returns a function that returns middleware. Do not instantiate with 'new'.","wrong":"app.use(new forceHttpsSchema())","symbol":"Express middleware function","correct":"app.use(forceHttpsSchema({ enabled: true }))"},{"note":"TypeScript types may not be bundled; check DefinitelyTyped or use a separate .d.ts file.","wrong":"import { Options } from 'express-force-https-schema'","symbol":"Configuration object type (TypeScript)","correct":"import type { Options } from 'express-force-https-schema'"}],"quickstart":{"code":"import express from 'express';\nimport forceHttpsSchema from 'express-force-https-schema';\n\nconst app = express();\n\napp.use(\n  forceHttpsSchema({\n    enabled: process.env.FORCE_HTTPS === 'true',\n    skipUserAgents: /ELB-HealthChecker/i\n  })\n);\n\napp.get('/', (req, res) => {\n  res.send('Hello HTTPS!');\n});\n\napp.listen(3000);","lang":"javascript","description":"Minimal Express app with HTTPS redirection middleware using X-Forwarded-Proto header, skipping health checks."},"warnings":[{"fix":"Manually append the original query string from req.url after redirection, or use middleware like express-sslify which handles this.","message":"The middleware does not handle redirection with query strings preserved.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Consider migrating to express-sslify or a custom middleware if security updates are needed.","message":"Package last updated in 2018; no active maintenance. May not support Express 4.x or later versions fully.","severity":"deprecated","affected_versions":">=1.0.0"},{"fix":"Ensure your reverse proxy (e.g., Nginx, AWS ELB) sets the header correctly. For local development, set a test header or disable the middleware.","message":"If the X-Forwarded-Proto header is missing or set incorrectly, requests may not redirect as expected.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"search_vec":"'1.0.3':31 '2018':39 'agent':79 'aw':26,91 'balanc':61 'base':12,48 'behind':22 'certain':77 'check':49,83 'common':20 'configur':6 'container':63 'detect':54 'direct':52 'disabl':81 'e.g':68 'elb':27 'enabl':86 'environ':64 'express':2,7,70,89 'express-force-https-schema':1 'express-sslifi':69 'flag':87 'forc':3,10,97 'forward':17,95 'header':19,47 'header-bas':46 'heroku':25,92 'https':4,11,90 'javascript':88 'last':37 'latest':34 'like':24 'load':60 'load-balanc':59 'mainten':41 'make':55 'middlewar':8,67 'mode':42 'nginx':29 'option':74 'proto':18,96 'protocol':53 'provid':73 'proxi':23 'rather':50 'releas':36 'schema':5 'similar':66 'skip':76 'sslifi':71 'stabl':35 'suitabl':57 'unlik':65 'updat':38 'use':21,44 'user':78 'version':30 'via':84 'x':16,94 'x-forwarded-proto':15,93","created_at":"2026-06-07T16:51:58.423793+00:00","updated_at":"2026-06-07T16:51:58.423793+00:00","problems":[{"fix":"Use import forceHttpsSchema from 'express-force-https-schema' or const forceHttpsSchema = require('express-force-https-schema').default","cause":"CommonJS require returns an object with default property instead of the function directly.","error":"TypeError: forceHttpsSchema is not a function"},{"fix":"Verify proxy configuration (e.g., set X-Forwarded-Proto to https) and ensure the middleware is only applied to non-HTTPS requests.","cause":"The proxy sets X-Forwarded-Proto as 'http' even after redirect, or the middleware does not check the final host.","error":"Redirect loop with infinite redirects"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/kilhage/express-force-https-schema#readme","github":"ssh://git@github.com/kilhage/express-force-https-schema","docs":null,"changelog":null,"pypi":null,"npm":"express-force-https-schema","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security","devops"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}